1. Field of Invention
The present invention relates to a method of watermarking mobile devices using their configuration settings so that remote systems trust interacting with them more.
2. Prior Art
The Internet is becoming an essential part of our everyday lives. People use the Internet to conduct commerce, communicate with friends, read the news, watch movies, get directions, etc. etc. This trend is intensifying even more with the rise of mobile phones. Mobile phones are owned by more than 90% of the US population. Even third world countries, which are currently too poor for mass adoption of personal computers, have impressive mobile phone adoption. Concurrently, the technical sophistication of mobile phones has advanced dramatically. Almost every new mobile phone has a built-in capability of accessing the Internet. These three amazing trends—the rise of the Internet, the rise of the mobile phone, and the technical advancement of the mobile phone—imply that soon, most people on the planet will have access to the Internet at any time and any place.
But there is a potential downside to this. While the Internet allows access to all sorts of useful information, if proper security is not in place, the Internet can allow other people to access your personal information fraudulently. In an extreme example, this personal information might be used to access your bank account. Of course, Internet security is not a new problem, in fact username/password authentication has been around for decades. However, now that the Internet contains so much sensitive personal information for so many people, username/password authentication is now seen as insufficient protection. Biometric technologies, such as fingerprint and iris recognition, have begun being used to authenticate users. IP address detection is sometimes used as a factor in authentication. All of these technologies, however, were not designed with mobile devices in mind. For example, an author of this patent recently used an IP “geo-location” service when connecting to the Internet through his phone. This service gave an address 200 miles away from where he actually was.
A new identification mechanism is needed for mobile devices, so that they can be authenticated and trusted by third parties.
Existing methods of identifying a mobile device include the following examples for mobile phones specifically. First, a phone may be identified by its International Mobile Equipment Identity (IMEI) number. An IMEI number is given to every phone using most of the newest cell networks (e.g. GSM, WCDMA, and iDEN). See Wikipedia's “International Mobile Equipment Identity” entry for more. However, accessing the IMEI number of a phone is typically not allowed in applications approved by the maker of a smart phone (e.g. an Apple iPhone application from the Apple iPhone App Store).
The Subscriber Identity Module (SIM) card number is another way of identifying a mobile phone. This number is usually only accessible by the cell network operator and the hardware layer of the phone. The reason for this is because if this number were leaked, someone could make fraudulent phone calls with the number, and that would lead to all sorts of problem for the phone company.
Apple iPhones and Research in Motion Blackberry's, in particular, are also given supposedly unique identification numbers. For Apple iPhones, the code to get the unique identification number is “[[UIDevice currentDevice] uniqueIdentifier]”. See the entry for “UIDevice” in the Apple IPhone Developer's online documentation for details.
All of these unique numbers associated with phones are 1) easy to forge and 2) persistent even if the phone changes ownership. They do not establish a link between the user of a phone and the phone itself.
Patent application Ser. No. 10/280,732 by James Uberti describes a mechanism to uniquely identify a person in a financial transaction based on a combination of their biometrics. This invention identifies a person, but does not foresee how to identify a mobile device. Plus, the biometrics presented in this application are neither novel nor particularly relevant to a mobile device.
U.S. Pat. No. 6,987,948 by G. Eric Engstrom et al. considers customizations users may make to their mobile devices, but it does not envision how these customizations can be used to uniquely identify those mobile devices.
U.S. Pat. No. 6,928,278 by Satoshi Shimomura describes the concept of a “total personal password” which includes only the name, address, date of birth, and phone number of a mobile phone user. This type of information is stored all over the Internet—not just on a mobile phone. And information that is typically stored only on mobile phones, such as contact lists and mobile phone settings, is not considered. As such, this patent does not think to utilize the unique advantages of the mobile device environment. Also, this patent does not consider the larger context of uniquely identify a mobile device. Instead, it focuses on games and examinations.
U.S. Pat. No. 6,862,610 by Gary Stephen Shuster describes an identification mechanism using many personal questions. This patent is focused on minimizing the number of personal questions that need to be answered so that user privacy is maximized. But that is a completely orthogonal topic compared to discussion of what personal questions could help uniquely identify a person or device. And this patent is silent about identification of mobile devices specifically.
“iPhone Privacy” by Nicolas Seriot, published for the Black Hat DC 2010 conference, lists many unique identifiers that applications installed on an iPhone are able to gather. But this paper suggests that it would be bad for applications to do this, since getting these identifiers might put user privacy in jeopardy. This paper does not recognize that these same unique identifiers can help legitimate applications prove the identify a mobile device to a third party.